NeoBeum Posted March 30, 2019 ID:1305962 Share Posted March 30, 2019 I'm in the middle of updating my dev tools and remembered that there were two cab files flagged as 'Trojan.FakeMS' on 25/06/2018. So from the date, I think this may have been the 1803 HLK Download packages using the HLKSetup.exe. This wasn't from mu_windows_10_hardware_lab_kit_version_1803_updated_march_2018_arm32_arm64_x64_x86_dvd_12064286.iso. Though, out of interest, I am downloading that iso again just to see if the cabinet files are present. The two files flagged in the 'Installers' directory are: 1f39792e6be0d2fa858e6696a60070c7.cab e68d05a40f5c0cc7bcc2f1f58607ea8a.cab I will post another report once the 1809 and 1803 HLK have finished downloading on my end and I get a chance to scan and upload a sample to virustotal. (Just posting this now - as I've already delayed 9 months and I will forget about it again if I don't do this now) Link to post Share on other sites More sharing options...
Staff miekiemoes Posted March 30, 2019 Staff ID:1305968 Share Posted March 30, 2019 Hi, Given these are scans from last year, mind to rescan again and let me know if these are still detected as the same? This since this should have been fixed for months already. Thanks! Link to post Share on other sites More sharing options...
NeoBeum Posted March 30, 2019 Author ID:1305974 Share Posted March 30, 2019 42 minutes ago, miekiemoes said: Hi, Given these are scans from last year, mind to rescan again and let me know if these are still detected as the same? This since this should have been fixed for months already. Thanks! The newly downloaded iso for 1803 have come back positive. The cabinet files found on mu_windows_10_hardware_lab_kit_version_1803_updated_march_2018_arm32_arm64_x64_x86_dvd_12064286.iso Only one cabinet file for the 1809 HLK also scan positive for 'Trojan.FakeMS' 1f39792e6be0d2fa858e6696a60070c7.cab VirusTotal is still processing the files... although I think the process has crashed as MBAM has frozen the files as Firefox is trying to upload Link to post Share on other sites More sharing options...
Staff shadowwar Posted March 30, 2019 Staff ID:1305975 Share Posted March 30, 2019 (edited) Please post the virustotal links when they are done processing. Can you also export the reports and copy and paste them here. It shows more information then the screenshot does. Thanks! Edited March 30, 2019 by shadowwar Link to post Share on other sites More sharing options...
NeoBeum Posted March 30, 2019 Author ID:1305976 Share Posted March 30, 2019 Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 30/03/2019 Scan Time: 22:36 Log File: 5077ee36-52e4-11e9-864d-1c872ce2247f.json -Software Information- Version: 3.7.1.2839 Components Version: 1.0.563 Update Package Version: 1.0.9924 Licence: Premium -System Information- OS: Windows 10 (Build 17763.379) CPU: x64 File System: NTFS User: NB-G751JY\NeoBeum -Scan Summary- Scan Type: Custom Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 117956 Threats Detected: 2 Threats Quarantined: 0 Time Elapsed: 2 min, 33 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 2 Trojan.FakeMS, C:\USERS\NEOBEUM\APPDATA\ROAMING\Microsoft\Windows\Recent\1f39792e6be0d2fa858e6696a60070c7.cab.lnk, No Action By User, [725], [54561],1.0.9924 Trojan.FakeMS, E:\WINDOWS\1809\HLK\INSTALLERS\1F39792E6BE0D2FA858E6696A60070C7.CAB, No Action By User, [725], [54561],1.0.9924 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 30/03/2019 Scan Time: 22:26 Log File: e55d90ca-52e2-11e9-b515-1c872ce2247f.json -Software Information- Version: 3.7.1.2839 Components Version: 1.0.563 Update Package Version: 1.0.9924 Licence: Premium -System Information- OS: Windows 10 (Build 17763.379) CPU: x64 File System: NTFS User: NB-G751JY\NeoBeum -Scan Summary- Scan Type: Custom Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 117949 Threats Detected: 2 Threats Quarantined: 0 Time Elapsed: 2 min, 42 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 2 Trojan.FakeMS, F:\INSTALLERS\1F39792E6BE0D2FA858E6696A60070C7.CAB, No Action By User, [725], [54561],1.0.9924 Trojan.FakeMS, F:\INSTALLERS\E68D05A40F5C0CC7BCC2F1F58607EA8A.CAB, No Action By User, [725], [54561],1.0.9924 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) Link to post Share on other sites More sharing options...
NeoBeum Posted March 30, 2019 Author ID:1305977 Share Posted March 30, 2019 VirusTotal has been stuck on 100% since I started typing the post... the original 2nd scan post... so has OPSWAT 1809 - 1f39792e6be0d2fa858e6696a60070c7.cab Kaspersky VirusDesk Scan result no threats detected File size 15.50 MB File type ARC/CAB Scan date Mar 30 2019 22:52:10 Databases release date Mar 30 2019 11:44:42 UTC MD5 c92bde8bb0ec9b2bab32ae2d6d688a53 SHA1 4453a985f595eb14ece1a6130519a55591cb83ac SHA256 d5fe479b0e151302e89486449666ad2b2ad9bf8d4d0be9411dfa11bf79a192da 1803 - 1f39792e6be0d2fa858e6696a60070c7.cab Kaspersky VirusDesk Scan result no threats detected File size 13.32 MB File type ARC/CAB Scan date Mar 30 2019 22:56:01 Databases release date Mar 30 2019 11:44:42 UTC MD5 16bce742fe227b4bae17318df0a433a4 SHA1 942a6b891f091a72e059a1c8ffdd1b3a709ae75b SHA256 6eb8a7f7e6b1e57eef1c879c3aa9fa56a090578c69930c4a84a42d2efa2de911 Link to post Share on other sites More sharing options...
NeoBeum Posted March 30, 2019 Author ID:1305978 Share Posted March 30, 2019 1803 - e68d05a40f5c0cc7bcc2f1f58607ea8a.cab Scan result no threats detected File size 8.31 MB File type ARC/CAB Scan date Mar 30 2019 23:01:06 Databases release date Mar 30 2019 11:44:42 UTC MD5 3d3c4aafb876d42906bcbc6bc4042ae4 SHA1 7e1e40bef0bee09a7c9d3dbcd5db8f2c3bdde369 SHA256 968f04811d404c2a06728d7fa6b4d29def1d941659cc70dfc0518415be56eb71 Link to post Share on other sites More sharing options...
NeoBeum Posted March 30, 2019 Author ID:1305981 Share Posted March 30, 2019 The links to the HLKSetup.exe are from https://docs.microsoft.com/en-us/windows-hardware/test/hlk/windows-hardware-lab-kit https://go.microsoft.com/fwlink/?linkid=2026646 https://go.microsoft.com/fwlink/p/?LinkId=873010 However, the ISO was obtained from my Azure Subscription Link to post Share on other sites More sharing options...
Staff miekiemoes Posted March 30, 2019 Staff ID:1305986 Share Posted March 30, 2019 Hi, Thanks. This helps. Verified as a false positive, so detection will be removed in next database update. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now